High

Anonymous role granted access to public.pricing_plans

Affected:: public.pricing_plans
Category:: Permissions
Confidence:: high
First detected:: 2026-08-12 11:04Z
Last verified:: 2026-08-16 09:41Z

Summary

anon has SELECT, and RLS policies allow access without identity verification.

Why this matters

Anyone with the publishable API key could potentially access this relation without signing in, depending on RLS.

Evidence

Role: anon
Privileges: SELECT
RLS Enabled: true
Managed: false
Applicable Policy: Public pricing is readable (USING: true)

Facts above were derived by the scanner from database metadata. No model output is involved in the verdict.

Technical details

RLS is enabled, but a policy applying to anon/PUBLIC has a permissive or easily bypassed USING clause.

Attack path

internet → anon → rest → public.pricing_plans

recommended remediation

Unlock the full security analysis

Buy full analysis

Review anonymous privileges on public.pricing_plans.

Current

-- Current state involves table grants and RLS status.

Proposed

-- REVIEW REQUIRED before changing:
-- REVOKE SELECT ON public.pricing_plans FROM anon;
-- OR:
-- ALTER TABLE public.pricing_plans ENABLE ROW LEVEL SECURITY;

Expected security effect

Modifying this could break legitimate public access or Supabase features.

Compatibility risk

high

Any public surface reading this relation without a session will break.

DBX never applies SQL to your database.